What is Cross Site Scripting (XSS)?
Say you have a comments section on your site and user A enters the following comment: I think it’s an outrage that more isn’t being done to stop the proliferation of widgets in our country. When you show that comment on your comments page it looks innocuous enough. But when user B else views that comments page, the javascript code embedded in the comment will harvest user B’s cookie for your site. Since cookies are often used to store login state, user A can potentially use that cookie to hijack the identity of person B on your site. A creative hacker could even try to use more sophisticated javascript to try to capture other user’s passwords as they type them into forms. The easiest and most draconian way to avoid this problem is to use a regex to remove any html from user comments. If you want to allow som
